Communicate ExtensionSettings policy to renderers

chrome/browser/extensions/extension_service.cc

Index: chrome/browser/extensions/extension_service.cc
diff --git a/chrome/browser/extensions/extension_service.cc b/chrome/browser/extensions/extension_service.cc
index 4cecaddab3e02cc9e9697c9d3f7a01d4ab746468..1b3141f69b4794f00596197e007ac9e66dbcf8c6 100644
--- a/chrome/browser/extensions/extension_service.cc
+++ b/chrome/browser/extensions/extension_service.cc
@@ -866,11 +866,18 @@ void ExtensionService::EnableExtension(const std::string& extension_id) {
   const Extension* extension =
       registry_->disabled_extensions().GetByID(extension_id);
 
+  extensions::ExtensionManagement* management =
+      extensions::ExtensionManagementFactory::GetForBrowserContext(profile());
+
   ManagementPolicy* policy = system_->management_policy();
   if (extension && policy->MustRemainDisabled(extension, nullptr, nullptr)) {
     UMA_HISTOGRAM_COUNTS_100("Extensions.EnableDeniedByPolicy", 1);
     return;
   }
+  extensions::PermissionsUpdater(profile()).SetRuntimeBlockedAllowedHosts(
+      extension, management->GetRuntimeBlockedHosts(extension),
+      management->GetRuntimeAllowedHosts(extension),
+      management->IsDefaultRuntimeBlockedAllowedHosts(extension));
 
   extension_prefs_->SetExtensionEnabled(extension_id);
 
@@ -1212,6 +1219,16 @@ void ExtensionService::CheckManagementPolicy() {
 
   extensions::ExtensionManagement* management =
       extensions::ExtensionManagementFactory::GetForBrowserContext(profile());
+  for (const auto& extension : registry_->enabled_extensions()) {
+    extensions::PermissionsUpdater(profile()).SetRuntimeBlockedAllowedHosts(
+        extension.get(), management->GetRuntimeBlockedHosts(extension.get()),
+        management->GetRuntimeAllowedHosts(extension.get()),
+        management->IsDefaultRuntimeBlockedAllowedHosts(extension.get()));
+  }
+  extensions::PermissionsUpdater(profile())
+      .SetDefaultRuntimeBlockedAllowedHosts(
+          management->GetDefaultRuntimeBlockedHosts(),
+          management->GetDefaultRuntimeAllowedHosts());
 
   // Loop through the disabled extension list, find extensions to re-enable
   // automatically. These extensions are exclusive from the |to_disable| and
@@ -1443,6 +1460,13 @@ void ExtensionService::OnLoadedInstalledExtensions() {
     if (SharedModuleInfo::IsSharedModule(extension.get()))
       to_enable.push_back(extension);
   }
+  extensions::ExtensionManagement* management =
+      extensions::ExtensionManagementFactory::GetForBrowserContext(profile());
+  extensions::PermissionsUpdater(profile())
+      .SetDefaultRuntimeBlockedAllowedHosts(
+          management->GetDefaultRuntimeBlockedHosts(),
+          management->GetDefaultRuntimeAllowedHosts());
+
   for (const auto& extension : to_enable) {
     EnableExtension(extension->id());
   }
@@ -1461,6 +1485,14 @@ void ExtensionService::AddExtension(const Extension* extension) {
     return;
   }
 
+  extensions::ExtensionManagement* settings =
+      extensions::ExtensionManagementFactory::GetForBrowserContext(profile());
+  CHECK(settings);

[zmin, 2016/12/22 22:15:39]

Do we have to use CHECK() here? What will happened if we can't get the settings?
Can we use the DCHECK instead?

[nrpeter, 2017/01/02 19:57:45]

I figured that if we aren't properly distributing security restrictions we'd
want hard fail. Is this not usually the case?

[zmin, 2017/01/03 19:42:16]

Looks like there're some CHECK(settings) in extension_service.cc already so I'm
OK with CHECK here.
However, is it possible/necessary to have something in between. For example,
block everything by default without getting settings properly?

[Devlin, 2017/01/09 23:30:57]

ExtensionManagementFactory is a BCKS - the only way this can fail is if our code
is very wrong.  DCHECK is sufficient.

[nrpeter, 2017/01/19 01:50:44]

Done.

+  extensions::PermissionsUpdater(profile()).SetRuntimeBlockedAllowedHosts(
+      extension, settings->GetRuntimeBlockedHosts(extension),
+      settings->GetRuntimeAllowedHosts(extension),
+      settings->IsDefaultRuntimeBlockedAllowedHosts(extension));
+
   bool is_extension_upgrade = false;
   bool is_extension_loaded = false;
   const Extension* old = GetInstalledExtension(extension->id());
@@ -1870,6 +1902,10 @@ void ExtensionService::OnExtensionManagementSettingsChanged() {
       extensions::PermissionsUpdater(profile()).RemovePermissionsUnsafe(
           extension.get(), *settings->GetBlockedPermissions(extension.get()));
     }
+    /*  extensions::PermissionsUpdater(profile()).SetRuntimeBlockedAllowedHosts(

[zmin, 2016/12/22 22:15:39]

Please remove this.

[nrpeter, 2017/01/19 01:50:44]

Done.

+          extension.get(), settings->GetRuntimeBlockedHosts(extension.get()),
+          settings->GetRuntimeAllowedHosts(extension.get()),
+          settings->IsDefaultRuntimeBlockedAllowedHosts(extension.get()));*/
   }
 
   CheckManagementPolicy();